CVE-2024-43381

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs when scanning a domain, and if the target domain's DNS record contains an XSS payload, it leads to the execution of malicious scripts in the reNgine's dashboard view when any user views the scan results. The XSS payload is directly fetched from the DNS record of the remote target domain. Consequently, an attacker can execute the attack without requiring any additional input from the target or the reNgine user. A patch is available and expected to be part of version 2.1.3.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-87

Affected software

No affected versions have been published.

Timeline

Published
Aug 16, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-433825.9Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypCVE-2024-433838.1Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library:CVE-2024-433848.0A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.CVE-2024-433858.8A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elemenCVE-2024-433868.8A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elemenCVE-2024-433878.8A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RCVE-2024-433888.8A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation.CVE-2024-433898.1A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGCVE-2024-43395.4The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to StoredCVE-2024-433908.1A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the CVE-2024-433918.1A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, netCVE-2024-433928.1A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, net
CVE-2024-43381: Medium severity, CVSS 5.4 | Vulnix